From c7a95dca1ced1fe726603e32156469a114fcca6e Mon Sep 17 00:00:00 2001 From: Dan Carpenter Date: Tue, 11 Mar 2025 08:51:19 +0900 Subject: [PATCH] crypto: qat/qat_420xx - fix off by one in uof_get_name() BugLink: https://bugs.launchpad.net/bugs/2101915 [ Upstream commit 93a11608fb3720e1bc2b19a2649ac2b49cca1921 ] This is called from uof_get_name_420xx() where "num_objs" is the ARRAY_SIZE() of fw_objs[]. The > needs to be >= to prevent an out of bounds access. Fixes: fcf60f4bcf54 ("crypto: qat - add support for 420xx devices") Signed-off-by: Dan Carpenter Acked-by: Giovanni Cabiddu Signed-off-by: Herbert Xu Signed-off-by: Sasha Levin CVE-2024-53163 Signed-off-by: Koichiro Den Signed-off-by: Stefan Bader --- drivers/crypto/intel/qat/qat_420xx/adf_420xx_hw_data.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/drivers/crypto/intel/qat/qat_420xx/adf_420xx_hw_data.c b/drivers/crypto/intel/qat/qat_420xx/adf_420xx_hw_data.c index 7b8abfb797ff..977ecb60bde8 100644 --- a/drivers/crypto/intel/qat/qat_420xx/adf_420xx_hw_data.c +++ b/drivers/crypto/intel/qat/qat_420xx/adf_420xx_hw_data.c @@ -428,7 +428,7 @@ static const char *uof_get_name(struct adf_accel_dev *accel_dev, u32 obj_num, else id = -EINVAL; - if (id < 0 || id > num_objs) + if (id < 0 || id >= num_objs) return NULL; return fw_objs[id];